Terraform Policy as Code (OPA Rego) Generator

Policy as code turns governance rules into reviewable, version-controlled Rego. The OPA Rego Generator writes a ready-to-use policy that iterates over a chosen Terraform resource type and flags violations such as missing tags or encryption settings. Instead of hand-writing the rule body and getting the input path wrong, you pick the package, rule kind, resource type and field, add a violation message, and receive valid Rego you can commit immediately. Writing Rego by hand is fiddly because the rule must iterate over a collection and reference the correct input path, and a single typo silently breaks enforcement.

You choose deny to block non-compliant infrastructure as a hard gate, or warn to surface violations without failing the run while policy is rolled out gradually. The output runs in Conftest against Terraform plan JSON or in OPA against any document that exposes resources under input.resource.. Input is validated, so an invalid package path or rule name is caught before you copy. Because everything runs in your browser, the policy is assembled locally and nothing is uploaded, which keeps your governance intent private. This is ideal for platform teams shipping guardrails as code and for proving in review that a standard is enforced. The generated rule follows the Conftest convention, so it drops into an existing policy suite without changes, and the Markdown copy makes it easy to document the rule alongside the code that enforces it.

• OPA Rego output - valid .rego ready for Conftest and OPA without manual edits or debugging.
• deny or warn - a hard gate that blocks, or a soft warning for gradual, low risk rollout.
• Any resource type - aws_instance, google_compute_instance, azurerm_* and any custom module type.
• Field assertion - flag resources missing a required attribute such as tags or encryption configuration.
• Severity metadata - the chosen severity is embedded as a comment for triage, dashboards and reports.
• Rule type stat - the cards show whether the rule is deny or warn at a glance after generation.
• Validation - package path and rule name are checked and explained in the error panel.
• Copy as Markdown - copy a documentation version of the policy for tickets, PRs and wikis.
• Copy / Download / Print - get policy.rego wherever you need it, in the format you prefer.
• Sample loader - prefill a realistic tagging policy to see the expected shape instantly.

1. Set the package - enter a Rego package such as terraform.aws that groups related rules.
2. Pick kind and name - choose deny or warn and give the rule a lowercase, descriptive name.
3. Choose the target - enter the resource type and the required field to assert presence of.
4. Write the message - describe the violation clearly for the reader of the policy report.
5. Pick severity - low, medium or high, recorded in the generated comment for triage.
6. Generate Rego - click the button and review the rule type stat and the preview output.
7. Export - copy, download policy.rego, print, or copy a Markdown version for documentation.
8. Run it - drop the .rego into Conftest and run it against a saved plan JSON to see violations.

Deny untagged instances: package terraform.aws, deny, aws_instance, field tags produces a rule that fails any instance without tags.

Warn unencrypted buckets: package terraform.aws, warn, aws_s3_bucket, field server_side_encryption_configuration surfaces buckets that are not encrypted without blocking the run.

Deny open security groups: package terraform.aws, deny, aws_security_group, field ingress blocks groups that expose an ingress block, a common misconfiguration.

Custom type: any resource type works, so you can enforce rules on modules and providers beyond the big three clouds.

• Valid Rego - runs in Conftest and OPA as written, with no input path mistakes.
• Flexible - any resource type and attribute can be the target of a compliance rule.
• Validated input - clear error messages stop bad package or rule names before they ship.
• Gradual rollout - warn mode lets teams adopt policy without breaking existing pipelines.
• Private - nothing leaves the browser, so governance intent stays on your machine.
• Documented - the Markdown copy turns a rule into a reviewable ticket note or wiki page.
• Consistent - every generated rule follows the same Conftest-friendly shape across the team.
• Portable - copy, download or print the policy wherever it is needed.